[builtins] Fix Array.p.join handling of an index getter with side effects

When creating the buffer for the fall back, the initial entry was not
considered when calculating the size.

Bug: chromium:896181
Change-Id: I7f15bb1bdf31b3255db91b1fe8dcd68c76033980
Reviewed-on: https://chromium-review.googlesource.com/c/1286957Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#56768}

src/builtins/array-join.tq

@@ -247,8 +247,10 @@ module array {
             deferred {
               loadJoinElements = LoadJoinElement<GenericElementsAccessor>;
 
+              // Join the current buffer into a single string and add it to a
+              // new buffer that the fall back will continue with.
               const temp: String = BufferJoin(buffer, sep);
-              buffer = BufferInit((len - k), sep);
+              buffer = BufferInit((len - k + 1), sep);
               buffer = BufferAdd(buffer, temp, 0, separatorLength);
             }
         }

test/mjsunit/array-join-index-getter-side-effects.js

@@ -48,6 +48,25 @@
 
   // Verifies cycle detection still works properly after continuation.
   assertSame('9,2', a.join());
+  assertSame(2, callCount);
+})();
+
+(function ArrayLengthIncreasedWithHole() {
+  let callCount = 0;
+  const a = [1, , 2];
+  Object.defineProperty(a, '1', {
+    configurable: true,
+    get() {
+      callCount++;
+      a.push(3);
+    }
+  });
+  assertSame('1,,2', a.join());
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after continuation.
+  assertSame('1,,2,3', a.join());
+  assertSame(2, callCount);
 })();
 
 (function ArrayLengthDecreased() {
@@ -66,6 +85,7 @@
 
   // Verifies cycle detection still works properly after continuation.
   assertSame('9', a.join());
+  assertSame(2, callCount);
 })();
 
 (function ElementsKindChangedToHoley() {
@@ -84,4 +104,5 @@
 
   // Verifies cycle detection still works properly after continuation.
   assertSame('9,1,', a.join());
+  assertSame(2, callCount);
 })();

test/mjsunit/regress/regress-crbug-896181.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = new Array();
+a[0] = 0.1;
+a[2] = 0.2;
+Object.defineProperty(a, 1, {
+  get: function() {
+    a[4] = 0.3;
+  },
+});
+
+assertSame('0.1,,0.2', a.join());